opnsense

Records55All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

opnsense records in CISA KEV

No opnsense vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Opnsense 36 records HIGH

Records

55 records

TI-2023-20247 CVE-2023-39008 · GHSA-58fg-qwhp-cmjh

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense…

HIGH 82

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0312 Published 2023-08-09 No fix listed CWE-77

TI-2023-20243 CVE-2023-39004 · GHSA-g5mw-r3hw-p72x

Insecure permissions in the configuration directory (/conf/) of OPNsense Community…

HIGH 82

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2023-08-09 No fix listed CWE-732

TI-2023-20240 CVE-2023-39001 · GHSA-j25w-8295-hc8c

A command injection vulnerability in the component diag_backup.php of OPNsense Community…

HIGH 82

A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configur…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03627 Published 2023-08-09 No fix listed CWE-77

TI-2023-11947 CVE-2023-27152 · GHSA-c359-g3mh-v8vw

DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers…

HIGH 82

DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01107 Published 2023-10-23 No fix listed CWE-307

TI-2026-74819 CVE-2026-57155

Path traversal in OPNsense GeoIP importer allows root code execution

HIGH 76

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00858 Published 2026-10-15 Fixed in 26.1.11 CWE-22

TI-2023-20246 CVE-2023-39007 · GHSA-wm32-j2xh-9mq5

/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and…

HIGH 76

/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02608 Published 2023-08-09 No fix listed CWE-79

TI-2026-26826 CVE-2026-34578

OPNsense has an LDAP Injection via Unsanitized Username in Authentication

HIGH 75

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00423 Published 2026-04-09 Fixed in 26.1.6 CWE-90

TI-2026-32173 CVE-2026-44194

OPNsense: RCE on user managment

HIGH 74

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.05673 Published 2026-05-13 Fixed in 26.1.8 CWE-78

TI-2026-32172 CVE-2026-44193

OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

HIGH 74

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00686 Published 2026-05-13 Fixed in 26.1.7 CWE-88

TI-2025-32291 CVE-2025-50989 · GHSA-qf7f-cgq3-xfvh

OS command injection in OPNsense

HIGH 74

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.1093 Published 2025-08-27 Fixed in 25.1.8 CWE-78

TI-2026-38642 CVE-2026-53581

ntp: write path traversal

HIGH 72

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.00473 Published 2026-09-08 Fixed in 26.1.9, 26.4_20 CWE-22

TI-2023-20244 CVE-2023-39005 · GHSA-jxgw-xv3v-x4jj

Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7…

HIGH 72

Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00719 Published 2023-08-09 No fix listed CWE-732

TI-2023-20242 CVE-2023-39003 · GHSA-2phw-mm8g-9jp8

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered…

HIGH 72

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00789 Published 2023-08-09 No fix listed CWE-732

TI-2026-74820 CVE-2026-58390

Stored cross-site scripting in OPNsense OpenVPN status views

HIGH 70

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00604 Published 2026-10-15 Fixed in 26.1.11 CWE-79

TI-2026-84461 CVE-2026-57154

Line injection in OPNsense configuration via multiple GUI text fields

HIGH 68

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0046 Published 2026-11-03 Fixed in 26.1.11 CWE-74

TI-2026-32174 CVE-2026-44195

OPNsense: Authentication lockout bypass

HIGH 68

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00318 Published 2026-05-13 Fixed in 26.1.7 CWE-307

TI-2026-23697 CVE-2026-30868

Cross-Site Request Forgery (CSRF) in opnsense/core

HIGH 68

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0017 Published 2026-03-11 Fixed in 26.1.4 CWE-352

TI-2026-74827 CVE-2026-71490

OPNsense core lets users bypass read-only configuration protection

MEDIUM 64

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0038 Published 2026-10-15 Fixed in 26.1.11 CWE-863

TI-2023-20238 CVE-2023-38999 · GHSA-hgxq-q79f-jvrh

A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense…

MEDIUM 62

A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00397 Published 2023-08-09 No fix listed CWE-352

TI-2019-15429 CVE-2019-25376 · GHSA-2444-5vx9-4q2f

OPNsense 19.1 Reflected XSS via proxy endpoint

MEDIUM 62

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0042 Published 2026-02-15 No fix listed CWE-79

TI-2019-15428 CVE-2019-25375 · GHSA-6333-cc9f-9589

OPNsense 19.1 Reflected XSS via monit interface

MEDIUM 62

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00416 Published 2026-02-15 No fix listed CWE-79

TI-2019-15427 CVE-2019-25374 · GHSA-prpr-jj7j-2v2f

OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php

MEDIUM 62

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00368 Published 2026-02-15 No fix listed CWE-79

TI-2026-74823 CVE-2026-58393

Path traversal in OPNsense OpenVPN override common_name writes files

MEDIUM 60

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.00433 Published 2026-10-15 Fixed in 26.1.11 CWE-22

TI-2023-20241 CVE-2023-39002 · GHSA-pwq6-w399-r46m

A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01202 Published 2023-08-09 No fix listed CWE-79

TI-2023-20239 CVE-2023-39000 · GHSA-xw95-hgq7-7c3x

A reflected cross-site scripting (XSS) vulnerability in the component…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00572 Published 2023-08-09 No fix listed CWE-79

Open these records in search →